elanous 0.2.34 → 0.2.35

package/src/skills/tools/agent.ts

@@ -60,8 +60,8 @@ export const AGENT_TOOL_DEFAULT_MAX_TURNS = 20;
 export const AGENT_TOOL_TURNS_CEILING = 50;
 
 /** Numeric ceiling on concurrent `run_in_background` Agent-tool fan-out.
- *  Pure declaration — enforcement in dispatchAgent is the follow-up cell
- *  TUI-AGENT-CAPS-WIRING (not wired here). */
+ *  Enforced at exactly one point in `dispatchAgent` (see the
+ *  `background-fanout-limit` block: after dedup, before `noteSeen`). */
 export const AGENT_TOOL_BACKGROUND_FANOUT_CEILING = 8;
 
 /** Clamp a caller-supplied `max_turns` onto `[1, AGENT_TOOL_TURNS_CEILING]`.
@@ -82,7 +82,9 @@ export function stripAgentToolForOneLevelNesting<T extends { name: string }>(
 }
 
 /** Live `run_in_background` tasks occupy fan-out slots until they terminal.
- *  Pure judgement — the ceiling check that uses it is TUI-AGENT-CAPS-WIRING. */
+ *  Counts a task list (e.g. `globalAgentRegistry.list()`). `dispatchAgent`
+ *  enforces the per-session ceiling over its own reservation ledger
+ *  (`backgroundFanoutSlots`) instead — see that field's doc. */
 export function countLiveBackgroundFanout(
   tasks: ReadonlyArray<{ background?: boolean; state?: string }>,
 ): number {
@@ -95,6 +97,35 @@ export function countLiveBackgroundFanout(
   return n;
 }
 
+/** Fallback fan-out session key for dispatches that carry no
+ *  `sessionCache` (agent-cli, one-off callers). All of their slots share
+ *  one process-wide bucket so the ceiling still binds for them. */
+const UNSCOPED_BACKGROUND_FANOUT_SESSION: object = Object.freeze({});
+
+/** Fan-out slots by session (the dispatching session's `SessionCache`
+ *  identity; WeakMap so a dropped session releases its key together with
+ *  the cache instance). A slot is RESERVED in the same synchronous block
+ *  as the ceiling check inside `dispatchAgent` — concurrent dispatches
+ *  that interleave at the async definition-resolution awaits cannot all
+ *  pass the check before any of them registers — and RELEASED when the
+ *  registered task reaches a terminal state (done/error/aborted) via
+ *  `globalAgentRegistry.onTaskDone`. A dispatch that throws before it
+ *  registers releases its own reservation (see
+ *  `releaseReservedFanoutSlot` inside `dispatchAgent`). */
+const backgroundFanoutSlots = new WeakMap<object, number>();
+
+/** Count this session's live fan-out slots (reserved or running). */
+export function countSessionBackgroundFanout(session: object): number {
+  return backgroundFanoutSlots.get(session) ?? 0;
+}
+
+/** Release one of this session's fan-out slots (floors at zero). */
+function releaseBackgroundFanoutSlot(session: object): void {
+  const live = backgroundFanoutSlots.get(session);
+  if (live === undefined || live <= 1) backgroundFanoutSlots.delete(session);
+  else backgroundFanoutSlots.set(session, live - 1);
+}
+
 /** Fallback agent when subagent_type is missing or unresolvable. The
  *  loader picks this up from src/agents/general-purpose.md — built
  *  inline below as a defensive default in case that file is removed. */
@@ -374,19 +405,22 @@ export async function dispatchAgent(
   // burn another turn on the same work. Return a stub that points
   // the parent back to its existing history. Parents stuck in a
   // "keep re-spawning Data Collector" loop escape via this gate.
-  if (opts.sessionCache) {
-    const key = agentCacheKey(requestedType, requestedType, prompt);
+  const sessionCache = opts.sessionCache;
+  const cacheKey = sessionCache
+    ? agentCacheKey(requestedType, requestedType, prompt)
+    : undefined;
+  if (sessionCache && cacheKey) {
     // Key strategy: description is noisy (parents sometimes vary the
     // label between calls); we hash the FUNCTIONAL signature only
     // — subagent_type + prompt. Same prompt to same agent = same
     // expected work, regardless of how the call was labelled.
-    const hit = opts.sessionCache.check(key);
+    const hit = sessionCache.check(cacheKey);
     if (hit) {
       const label = `Agent[${requestedType}] "${description.slice(0, 60)}"`;
       logDedupHit('agent.dedup', label, hit, {
         requestedType,
         description: description.slice(0, 80),
-        consecutive: opts.sessionCache.consecutiveHits,
+        consecutive: sessionCache.consecutiveHits,
       });
 
       // Runtime-level block: same treatment as Read. When the parent
@@ -395,16 +429,16 @@ export async function dispatchAgent(
       // tool_result carries is_error=true. Soft stubs have been
       // observed to produce 6+ retries in the wild; an error break
       // the reflex loop more reliably.
-      if (opts.sessionCache.consecutiveHits >= CONSECUTIVE_DEDUP_BLOCK_THRESHOLD) {
+      if (sessionCache.consecutiveHits >= CONSECUTIVE_DEDUP_BLOCK_THRESHOLD) {
         debug.log('agent.dedup', 'consecutive-block', {
           requestedType,
           description: description.slice(0, 80),
-          consecutive: opts.sessionCache.consecutiveHits,
+          consecutive: sessionCache.consecutiveHits,
           threshold: CONSECUTIVE_DEDUP_BLOCK_THRESHOLD,
         });
         throw new Error(
           `RUNTIME BLOCKED — Agent[${requestedType}] "${description.slice(0, 60)}" ` +
-          `has been spawned ${opts.sessionCache.consecutiveHits} times in a row with ` +
+          `has been spawned ${sessionCache.consecutiveHits} times in a row with ` +
           `no intervening progress. The previous sub-agent's final message is in ` +
           `your conversation history above — use that. Spawn an Agent with a ` +
           `DIFFERENT persona (different subagent_type or a substantively different ` +
@@ -420,9 +454,9 @@ export async function dispatchAgent(
       // ~500 chars of history noise per hit. We now emit the debug
       // event past threshold for traceability but return the normal
       // "spawn a different persona" stub — same message every hit.
-      if (opts.sessionCache.totalHits >= DEDUP_CASCADE_HALT_THRESHOLD) {
+      if (sessionCache.totalHits >= DEDUP_CASCADE_HALT_THRESHOLD) {
         debug.log('agent.dedup', 'cascade-threshold', {
-          totalHits: opts.sessionCache.totalHits,
+          totalHits: sessionCache.totalHits,
           threshold: DEDUP_CASCADE_HALT_THRESHOLD,
           requestedType,
           description: description.slice(0, 80),
@@ -444,7 +478,79 @@ export async function dispatchAgent(
         taskId: 'dedup',
       };
     }
-    opts.sessionCache.noteSeen(key, `Agent[${requestedType}] ${description.slice(0, 60)}`);
+  }
+
+  // ── TUI-AGENT-CAPS-FU: background fan-out ceiling ──
+  //
+  // The ONE enforcement point for AGENT_TOOL_BACKGROUND_FANOUT_CEILING, and
+  // it sits exactly between the dedup short-circuit above and `noteSeen`
+  // below on purpose:
+  //   • after dedup — a repeat of an already-answered prompt still gets the
+  //     dedup stub instead of a fan-out refusal (it never reaches here);
+  //   • before `noteSeen` — a refused launch must NOT register its cache
+  //     key. Otherwise the caller's retry (same prompt, once a slot opens)
+  //     would be answered with "you already got this result" even though no
+  //     child ever ran, permanently poisoning the cache with a spawn that
+  //     never happened.
+  //
+  // Live slots are counted over the shared task ledger: `background` tasks
+  // that have not reached a terminal state (done / error / aborted). So a
+  // slot re-opens the moment any background agent finishes, which is what
+  // lets the next launch through again.
+  let fanoutSession: object | undefined;
+  if (runInBackground) {
+    // Per-session scope: slots count against THIS session's cache
+    // identity (shared fallback bucket for cache-less callers), so a
+    // busy OTHER session cannot starve this one's first launch.
+    fanoutSession = opts.sessionCache ?? UNSCOPED_BACKGROUND_FANOUT_SESSION;
+    const liveBackground = countSessionBackgroundFanout(fanoutSession);
+    if (liveBackground >= AGENT_TOOL_BACKGROUND_FANOUT_CEILING) {
+      debug.log('agent.spawn', 'background-fanout-limit', {
+        cid: debugCorrelationId,
+        requestedType,
+        description: description.slice(0, 80),
+        liveBackground,
+        ceiling: AGENT_TOOL_BACKGROUND_FANOUT_CEILING,
+      }, { level: 'warn' });
+      // Not spawned: no registry task, no provider call, no cache entry.
+      // taskId is a sentinel (like 'dedup' above) so a caller can tell a
+      // refusal from a real spawn without parsing the prose.
+      return {
+        output:
+          `NOT SPAWNED — ${liveBackground} background agents are already live and the ` +
+          `fan-out ceiling is ${AGENT_TOOL_BACKGROUND_FANOUT_CEILING}. A slot reopens as ` +
+          `soon as one of them reaches a terminal state (done/error/aborted); its result ` +
+          `then arrives as a task-notification. Either wait for one to finish, fold this ` +
+          `work into an existing background spawn, or re-issue it without ` +
+          `run_in_background so it runs in the foreground.`,
+        agent: requestedType,
+        cid: debugCorrelationId,
+        durationMs: 0,
+        maxTurns: requestedMaxTurns,
+        taskId: 'background-fanout-limit',
+      };
+    }
+  }
+
+  if (fanoutSession !== undefined) {
+    // Atomic reservation: taken in the SAME synchronous block as the
+    // ceiling check above, before any await — concurrent dispatches
+    // cannot all pass the check and push this session past the ceiling
+    // while their definitions resolve. Released when the registered
+    // task terminals (see the onTaskDone subscription at spawn); a
+    // dispatch that throws before registering releases it in the finally
+    // below, including failures from definition resolution and lazy imports.
+    backgroundFanoutSlots.set(fanoutSession, countSessionBackgroundFanout(fanoutSession) + 1);
+  }
+  const releaseReservedFanoutSlot = (): void => {
+    if (fanoutSession === undefined) return;
+    releaseBackgroundFanoutSlot(fanoutSession);
+    fanoutSession = undefined;
+  };
+
+  try {
+  if (sessionCache && cacheKey) {
+    sessionCache.noteSeen(cacheKey, `Agent[${requestedType}] ${description.slice(0, 60)}`);
   }
 
   // Resolve the agent definition. Try the 4-layer resolver first;
@@ -536,7 +642,9 @@ export async function dispatchAgent(
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      if (!message.includes('is not inside a git repo')) throw error;
+      if (!message.includes('is not inside a git repo')) {
+        throw error;
+      }
       childCwd = opts.cwd ?? getSessionCwd();
       appliedIsolation = 'cwd';
       debug.log('agent.spawn', 'worktree-fallback-cwd', {
@@ -679,6 +787,19 @@ export async function dispatchAgent(
     ...(runInBackground ? { background: true } : {}),
   });
 
+  // Terminal release for this dispatch's reserved fan-out slot: the
+  // registry fires this exactly once per task when it reaches a
+  // terminal state (done/error/aborted); until then the slot counts as
+  // occupied against this session's ceiling above.
+  if (fanoutSession !== undefined) {
+    const fanoutSlotSession = fanoutSession;
+    const fanoutSlotSubscription = globalAgentRegistry.onTaskDone((task) => {
+      if (!task || task.id !== handle.task.id) return;
+      fanoutSlotSubscription.dispose();
+      releaseBackgroundFanoutSlot(fanoutSlotSession);
+    });
+    fanoutSession = undefined;  // the terminal subscription owns the release now
+  }
   // Forward parent abort to the spawned task. The registry owns the
   // child's controller; we just chain ours into it.
   if (opts.signal) {
@@ -907,4 +1028,9 @@ export async function dispatchAgent(
     ...(childCwd ? { cwd: childCwd } : {}),
     ...(appliedIsolation ? { isolation: appliedIsolation } : {}),
   };
+  } finally {
+    // The registered task owns its slot after the handoff above. Every
+    // pre-registration throw leaves fanoutSession set and releases it here.
+    releaseReservedFanoutSlot();
+  }
 }

package/src/skills/tools/msg-ask.ts

@@ -0,0 +1,100 @@
+import type { LLMToolSpec } from '../../llm.js';
+import { openMsgStore, validateMessageEnvelope, type Message, type MsgStore } from '../../msg/msg-store.js';
+
+export interface MsgAskDeps {
+  openStore?: () => MsgStore;
+  sleep?: (ms: number) => Promise<void>;
+  monotonicNow?: () => number;
+  wallNow?: () => number;
+  signal?: AbortSignal;
+}
+
+export interface MsgAskResult extends Record<string, unknown> {
+  output: string;
+  ok: boolean;
+  question: Message;
+  reply: Message | null;
+}
+
+export function buildMsgAskTool(): LLMToolSpec {
+  return {
+    name: 'MsgAsk',
+    description: 'Post a durable seat question, then wait for the first message whose replyTo points to it. A timeout or cancellation keeps the posted question and returns its ID for later follow-up.',
+    parameters: {
+      type: 'object',
+      properties: {
+        from: { type: 'string', description: 'Asking seat (ALL cannot send).' },
+        to: { type: 'string', description: 'Recipient seat.' },
+        question: { type: 'string', description: 'Nonempty question body.' },
+        waitSeconds: { type: 'integer', description: 'Wait 0–300 seconds; default 60.' },
+      },
+      required: ['from', 'to', 'question'],
+      additionalProperties: false,
+    },
+  };
+}
+
+export async function dispatchMsgAsk(rawArgs: Record<string, unknown>, deps: MsgAskDeps = {}): Promise<MsgAskResult> {
+  const waitRaw = rawArgs.waitSeconds ?? 60;
+  if (typeof waitRaw !== 'number' || !Number.isSafeInteger(waitRaw) || waitRaw < 0 || waitRaw > 300) {
+    throw new Error("'waitSeconds' must be an integer between 0 and 300");
+  }
+  const envelope = validateMessageEnvelope({
+    from: rawArgs.from,
+    to: rawArgs.to,
+    body: rawArgs.question,
+  });
+  if (envelope.to === 'ALL') throw new Error("'to' must name one recipient seat for MsgAsk");
+  const monotonicNow = deps.monotonicNow ?? (() => performance.now());
+  const wallNow = deps.wallNow ?? Date.now;
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  const store = deps.openStore?.() ?? openMsgStore();
+  try {
+    if (deps.signal?.aborted) throw new Error('ask cancelled before posting');
+    const question = store.post(envelope);
+    const startedAt = monotonicNow();
+    const wallStartedAt = wallNow();
+    const deadline = startedAt + waitRaw * 1000;
+    const wallDeadline = Date.parse(question.createdAt) + waitRaw * 1000;
+    // Ledger timestamps are wall time while the wait budget is monotonic.
+    // If the two clocks diverge materially, preserve the question ID and
+    // make the uncertain result explicit instead of accepting a late reply.
+    const clockAdjusted = () => Math.abs((wallNow() - wallStartedAt) - (monotonicNow() - startedAt)) > 250;
+    let afterId = 0;
+    do {
+      if (deps.signal?.aborted) {
+        return { output: `MsgAsk #${question.id} posted; wait cancelled`, ok: false, question, reply: null };
+      }
+      if (clockAdjusted()) {
+        return { output: `MsgAsk #${question.id} posted; clock adjusted during wait, inspect linked replies`, ok: false, question, reply: null };
+      }
+      const replies = store.listReplies(question.id, 1000, afterId);
+      if (clockAdjusted()) {
+        return { output: `MsgAsk #${question.id} posted; clock adjusted during wait, inspect linked replies`, ok: false, question, reply: null };
+      }
+      for (const reply of replies) {
+        afterId = reply.id;
+        // A replyTo link alone does not prove the intended seat answered.
+        // A wall-clock timestamp can move backwards by less than the clock
+        // adjustment guard. Never accept a reply once monotonic time expired.
+        // This conservatively leaves replies observed late for follow-up.
+        if (reply.from === question.to && reply.to === question.from
+          && monotonicNow() <= deadline && Date.parse(reply.createdAt) <= wallDeadline) {
+          return { output: `MsgAsk #${question.id} → reply #${reply.id}: ${reply.body}`, ok: true, question, reply };
+        }
+      }
+      const remaining = deadline - monotonicNow();
+      if (deps.signal?.aborted) {
+        return { output: `MsgAsk #${question.id} posted; wait cancelled`, ok: false, question, reply: null };
+      }
+      if (remaining <= 0) {
+        return { output: `MsgAsk #${question.id} posted; no linked reply within ${waitRaw}s`, ok: false, question, reply: null };
+      }
+      // A full page may repeat forever. Yield so timers and AbortSignal
+      // callbacks can run before asking SQLite for the next page.
+      await sleep(replies.length === 1000 ? 0 : Math.min(100, remaining));
+    } while (true);
+  } finally {
+    store.close();
+  }
+}

package/src/skills/tools/ops-ledger.ts

@@ -3,7 +3,7 @@
 // OP TUI turns previously drove `elanous msg list/post/ack` and
 // `elanous release checklist list/move/set/add` through RunShell:
 // 1.3–2s of CLI startup per call, 30+ spawns per turn, and the CLI's
-// human-oriented stdout amplifying TUI screen defects. These eight
+// human-oriented stdout amplifying TUI screen defects. These
 // tools reuse the SAME durable services in-process —
 //
 //   • msg tools → src/msg/msg-store.ts (the SQLite ledger `elanous msg`
@@ -11,6 +11,7 @@
 //   • checklist tools → src/release-loop/checklist.ts + feature-store.ts
 //     (the same per-version ledger, claim history, seat/OP move rules)
 //
+// MsgAsk joins this family through msg-ask.ts; the other dispatchers live here.
 // The permission and audit contract is preserved 1:1:
 //   • writes record the actor from ELANOUS_TRACK (seat identity),
 //   • ChecklistMove keeps the CLI routing — anonymous (no ELANOUS_TRACK)

package/src/steward/hold-hygiene.ts

@@ -5,7 +5,7 @@ import { opSeatStatePath, readTrafficSignal } from '../seat-loop/traffic-signal.
 
 const SEATS = ['OP', 'MK', 'TC', 'UX'] as const;
 type Seat = typeof SEATS[number];
-export type HygieneCell = { id: string; owner?: string | null; status: string };
+export type HygieneCell = { id: string; owner?: string | null; status: string; title?: string };
 export type HygieneNotice = { to: Seat; key: string; body: string };
 export type HygieneDeps = {
   root: string;
@@ -45,7 +45,7 @@ export function starvingCycles(log: string): { reasons: Record<string, number> }
   return { reasons };
 }
 
-type HoldMeta = { id?: unknown; op?: unknown; reason?: unknown; until?: unknown };
+type HoldMeta = { id?: unknown; op?: unknown; reason?: unknown; until?: unknown; kind?: unknown; confirmedAt?: unknown; at?: unknown; title?: unknown };
 function holdMetadata(path: string): Map<string, HoldMeta> {
   const latest = new Map<string, HoldMeta>();
   for (const line of (readOptional(path) ?? '').split(/\r?\n/)) {
@@ -65,6 +65,10 @@ function untilTime(value: unknown): number | null {
   return Number.isFinite(time) ? time : null;
 }
 
+function confirmedTime(value: unknown): number | null {
+  return typeof value === 'string' && /^\d{12}$/.test(value) ? untilTime(value) : null;
+}
+
 export function inspectHoldHygiene(deps: HygieneDeps): HygieneNotice[] {
   const notices: HygieneNotice[] = [];
   const dir = deps.dispatcherDir ?? opSeatStatePath('feeder');
@@ -88,11 +92,25 @@ export function inspectHoldHygiene(deps: HygieneDeps): HygieneNotice[] {
     if (!SEATS.some(seat => seat === owner)) continue;
     const meta = metadata.get(cell.id);
     const reason = meta?.op === 'add' && typeof meta.reason === 'string' ? meta.reason.trim() : '';
-    const expiry = untilTime(meta?.until);
-    const expired = typeof meta?.until === 'string' && meta.until.trim() !== '' && (expiry === null || expiry <= deps.now.getTime());
-    if (reason && !expired) continue;
+    let attention = '';
+    if (meta?.kind === '손작업') {
+      const confirmed = confirmedTime(meta.confirmedAt ?? meta.at);
+      if (confirmed === null) attention = '재확인 시각 없음';
+      else if (deps.now.getTime() - confirmed >= 24 * 60 * 60_000) attention = '24h 재확인 지연';
+    } else if (meta?.kind === '재발사금지') {
+      if (typeof meta.title !== 'string' || !meta.title || typeof cell.title !== 'string' || !cell.title) attention = '제목 기준 확인 불가';
+      else if (cell.title !== meta.title) attention = '칸 제목 변경';
+    } else if (meta?.kind === '선행대기' || meta?.kind === undefined || meta?.kind === '') {
+      const expiry = untilTime(meta?.until);
+      if (expiry === null) attention = 'until 확인 불가';
+      else if (expiry <= deps.now.getTime()) attention = `until ${String(meta?.until)} 지남`;
+    } else attention = 'hold 종류 확인 불가';
+    if (reason && !attention) continue;
+    const guidance = meta?.kind === '손작업' ? '재확인 시각·사유를 판단해 OP에 알려 주세요.'
+      : meta?.kind === '재발사금지' ? '칸 제목과 기준 제목·사유를 대조해 OP에 알려 주세요.'
+        : '풀기/유지(사유·until)를 판단해 OP에 알려 주세요.';
     notices.push({ to: owner as Seat, key: `hold:${cell.id}:${owner}`,
-      body: `노랑 칸 ${cell.id} traffic hold: ${!reason ? '사유 없음' : `사유 ${reason}`} ${expired ? `· until ${String(meta?.until)} 지남` : ''}. 풀기/유지(사유·until)를 판단해 OP에 알려 주세요. 자동 해제하지 않습니다.` });
+      body: `노랑 칸 ${cell.id} traffic hold: ${!reason ? '사유 없음' : `사유 ${reason}`} ${attention ? `· ${attention}` : ''}. ${guidance} 자동 해제하지 않습니다.` });
   }
   return notices;
 }

package/src/steward/triage-budget.ts

@@ -1,4 +1,6 @@
 import { createHash } from 'node:crypto';
+import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { debug } from '../debug/log.js';
 import type { TriageDecision, TriageIssue } from './triage.js';
 import { InvalidWorkingBackwardsDraft } from './working-backwards.js';
@@ -187,3 +189,195 @@ export async function draftWithinBudget<T>({ wishes, draft, concurrency = 4, per
   debug.log('steward.triage', 'draft-budget', stats);
   return { ...result, stats };
 }
+
+/** Consecutive healthy shadow ticks before a live move is safe to record. */
+export const LIVE_AFTER_TICKS = 3;
+
+/** Reasons a decision is a placeholder, not a judgment — they must never be reused as if they were fresh. */
+const TEMPORARY_WHYS = ['triage deferred — deadline', 'triage judgment timed out — human review',
+  'triage judgment unavailable — human review'];
+
+export function isTemporaryDecision(decision: TriageDecision): boolean {
+  return decision.rung === 'hitl' && decision.hitlReason === 'other' && TEMPORARY_WHYS.includes(decision.why);
+}
+
+export interface TriageTickCycle {
+  /** sha256 of this tick's sorted issue identifiers — the batch fingerprint. */
+  key: string;
+  /** Consecutive ticks (this one included) that carried the same fingerprint. */
+  ticks: number;
+}
+
+export interface TriageTickBudget {
+  cycle: TriageTickCycle;
+  deadlineMs: number;
+  perIssueMs: number;
+  concurrency: number;
+  /** `repeat-tick` when the same batch already arrived in the previous tick. */
+  basis: 'first-tick' | 'repeat-tick';
+}
+
+export type TriageItemOutcome = 'reused' | 'judged' | 'timed-out' | 'unavailable' | 'deferred';
+
+export interface TriageItemEvent {
+  /** 1-based position of the issue in this tick's batch. */
+  index: number;
+  /** Which tick cycle the item was judged in. */
+  cycle: number;
+  issue: string;
+  outcome: TriageItemOutcome;
+  /** No fresh judgment backs this item — the next tick (or a human) must pick it up. */
+  degraded: boolean;
+  why: string;
+}
+
+export interface TriageItemMetrics {
+  items: number;
+  fresh: number;
+  reused: number;
+  degraded: number;
+  byOutcome: Record<TriageItemOutcome, number>;
+}
+
+export interface TriageTickHealth {
+  degraded: string[];
+  /** Degraded last tick, freshly judged this tick. */
+  healed: string[];
+  health: 'healthy' | 'healing' | 'degraded';
+  /** Consecutive non-degraded shadow ticks. */
+  liveStreak: number;
+  /** Shadow has stayed healthy long enough that a live move is safe; the mode itself is not flipped here. */
+  liveEligible: boolean;
+  transition?: 'shadow→live' | 'live→shadow';
+}
+
+export interface TriageTickRecord extends TriageTickHealth {
+  at: string;
+  mode: string;
+  key: string;
+  ticks: number;
+  issues: number;
+  deadlineMs: number;
+  perIssueMs: number;
+  concurrency: number;
+  reused: number;
+  judged: number;
+  timedOut: number;
+  deferred: number;
+  events: TriageItemEvent[];
+}
+
+export function triageTickKey(issues: TriageIssue[]): string {
+  return createHash('sha256').update(JSON.stringify(issues.map(issue => issue.identifier).sort())).digest('hex').slice(0, 16);
+}
+
+/** The tick cycle: a batch that keeps re-arriving is the same cycle, counted up; a changed batch starts at 1. */
+export function triageTickCycle(previous: Pick<TriageTickRecord, 'key' | 'ticks'> | undefined, key: string): TriageTickCycle {
+  const ticks = previous && previous.key === key && Number.isFinite(previous.ticks) ? Math.max(1, previous.ticks) + 1 : 1;
+  return { key, ticks };
+}
+
+/**
+ * Budget derived from the tick cycle: the stage deadline is fixed per tick, but a repeat cycle widens each issue's
+ * slice (up to 3×) instead of re-running the same timeout on the batch that already ran out of window last tick.
+ */
+export function triageTickBudget({ cycle, issueCount, deadlineMs = 240_000, basePerIssueMs = 90_000, maxConcurrency = 8 }: {
+  cycle: TriageTickCycle;
+  issueCount: number;
+  deadlineMs?: number;
+  basePerIssueMs?: number;
+  maxConcurrency?: number;
+}): TriageTickBudget {
+  const count = Math.max(1, Math.floor(issueCount));
+  const concurrency = Math.max(1, Math.min(Math.max(1, Math.floor(maxConcurrency)), count));
+  const stretch = Math.min(Math.max(1, Math.floor(cycle.ticks)), 3);
+  return { cycle, deadlineMs, perIssueMs: Math.min(deadlineMs, basePerIssueMs * stretch), concurrency,
+    basis: cycle.ticks > 1 ? 'repeat-tick' : 'first-tick' };
+}
+
+/** One event per item: what actually happened to it this tick and whether that leaves it degraded. */
+export function triageItemEvents({ cycle, issues, decisions, previous = [] }: {
+  cycle: TriageTickCycle;
+  issues: TriageIssue[];
+  decisions: Array<TriageDecision & { inputHash?: string; deferred?: true }>;
+  previous?: Array<TriageDecision & { inputHash?: string }>;
+}): TriageItemEvent[] {
+  const judged = new Map(decisions.map(decision => [decision.issue, decision]));
+  const earlier = new Map(previous.map(decision => [decision.issue, decision]));
+  const events: TriageItemEvent[] = [];
+  for (const [index, issue] of issues.entries()) {
+    const decision = judged.get(issue.identifier);
+    const before = earlier.get(issue.identifier);
+    let outcome: TriageItemOutcome;
+    if (!decision) outcome = 'unavailable';
+    else if (decision.deferred === true) outcome = 'deferred';
+    else if (decision.why === 'triage judgment timed out — human review') outcome = 'timed-out';
+    else if (decision.why === 'triage judgment unavailable — human review') outcome = 'unavailable';
+    else if (before && before.inputHash !== undefined && before.inputHash === decision.inputHash &&
+      !before.deferred && !isTemporaryDecision(before)) outcome = 'reused';
+    else outcome = 'judged';
+    events.push({ index: index + 1, cycle: cycle.ticks, issue: issue.identifier, outcome,
+      degraded: outcome !== 'judged' && outcome !== 'reused',
+      why: decision?.why ?? 'triage decision missing' });
+  }
+  return events;
+}
+
+export function triageItemMetrics(events: TriageItemEvent[]): TriageItemMetrics {
+  const byOutcome: Record<TriageItemOutcome, number> = { reused: 0, judged: 0, 'timed-out': 0, unavailable: 0, deferred: 0 };
+  for (const event of events) byOutcome[event.outcome]++;
+  const reused = byOutcome.reused;
+  return { items: events.length, fresh: byOutcome.judged, reused,
+    degraded: events.filter(event => event.degraded).length, byOutcome };
+}
+
+/** Healing and the shadow→live transition, read off the previous real tick — never off an assumed one. */
+export function triageTickHealth({ previous, mode, events }: {
+  previous?: Pick<TriageTickRecord, 'mode' | 'degraded' | 'liveStreak'>;
+  mode: string;
+  events: TriageItemEvent[];
+}): TriageTickHealth {
+  const degraded = events.filter(event => event.degraded).map(event => event.issue);
+  const healed = (previous?.degraded ?? []).filter(issue => !degraded.includes(issue)).sort();
+  const health = healed.length ? 'healing' : degraded.length ? 'degraded' : 'healthy';
+  // Any degradation still present this tick resets the streak — a healed item next to a degraded one is not a healthy tick.
+  const liveStreak = mode === 'shadow' ? (degraded.length ? 0 : (previous?.mode === 'shadow' ? previous.liveStreak + 1 : 1)) : 0;
+  const transition = previous && previous.mode !== mode
+    ? (mode === 'live' && previous.mode === 'shadow' ? 'shadow→live'
+      : mode === 'shadow' && previous.mode === 'live' ? 'live→shadow' : undefined)
+    : undefined;
+  return { degraded, healed, health, liveStreak, liveEligible: mode === 'shadow' && liveStreak >= LIVE_AFTER_TICKS,
+    ...(transition ? { transition } : {}) };
+}
+
+export function triageTickLedgerPath(root: string): string {
+  return join(root, 'steward', 'triage-ticks.jsonl');
+}
+
+/** The real ticks that already ran, oldest first. A torn line is not a tick. */
+export function readTriageTicks(root: string, limit = 24): TriageTickRecord[] {
+  let text: string;
+  try { text = readFileSync(triageTickLedgerPath(root), 'utf8'); } catch { return []; }
+  const records: TriageTickRecord[] = [];
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue;
+    try {
+      const parsed: unknown = JSON.parse(line);
+      if (parsed && typeof parsed === 'object' && typeof (parsed as { mode?: unknown }).mode === 'string' &&
+        typeof (parsed as { key?: unknown }).key === 'string' && typeof (parsed as { ticks?: unknown }).ticks === 'number' &&
+        Array.isArray((parsed as { degraded?: unknown }).degraded) && Array.isArray((parsed as { events?: unknown }).events)) {
+        records.push(parsed as TriageTickRecord);
+      }
+    } catch { /* torn line */ }
+  }
+  return records.slice(-Math.max(1, limit));
+}
+
+export function appendTriageTick(root: string, record: TriageTickRecord): void {
+  try {
+    mkdirSync(join(root, 'steward'), { recursive: true });
+    appendFileSync(triageTickLedgerPath(root), `${JSON.stringify(record)}\n`);
+  } catch (error) {
+    debug.log('steward.triage', 'tick-ledger-failed', { reason: String(error) }, { level: 'warn' });
+  }
+}

package/src/steward/triage.ts

@@ -130,7 +130,7 @@ export function trackTablePrompt(tracks?: Record<string, string>): string {
   return `\n담당 트랙(owner) — 아래 중 하나(${keys.map(k => JSON.stringify(k)).join('|')}) · 이슈가 어느 트랙 일인지:\n${keys.map(k => `- ${k}: ${tracks[k]}`).join('\n')}`;
 }
 
-export async function triageIssues(issues: TriageIssue[], judge?: NonNullable<StewardDeps['judge']>, decide: typeof emitDecision = emitDecision, tracks?: Record<string, string>, previous: Array<TriageDecision & { inputHash?: string }> = [], ask: StewardAsk = askSteward): Promise<TriageDecision[]> {
+export async function triageIssues(issues: TriageIssue[], judge?: NonNullable<StewardDeps['judge']>, decide: typeof emitDecision = emitDecision, tracks?: Record<string, string>, previous: Array<TriageDecision & { inputHash?: string }> = [], ask: StewardAsk = askSteward, budget?: { deadlineMs: number; perIssueMs: number; concurrency: number }): Promise<TriageDecision[]> {
   const started = judge ? 0 : Date.now();
   const classified: ClassifiedIssue[] = [];
   const classifiedIds = new Set<string>();
@@ -144,7 +144,7 @@ export async function triageIssues(issues: TriageIssue[], judge?: NonNullable<St
     decide({ kind: result.rung === 'hitl' ? 'ESCALATE' : 'ROUTE', what: result.issue, reason: result.why,
       purpose: 'steward triage', target: result.owner ? `${result.rung} · ${result.owner}` : String(result.rung), refs: { issue: result.issue } });
   };
-  const { decisions } = await triageWithinBudget({ issues, previous, tracks, judge: async (issue, observedIssues) => {
+  const { decisions } = await triageWithinBudget({ issues, previous, tracks, ...(budget ?? {}), judge: async (issue, observedIssues) => {
     try {
       if (judge) return parseJudgment(issue, await judge(issue, observedIssues ?? issues, tracks), tracks);
       const byRule = ruleJudgment(issue, observedIssues ?? issues);
@@ -487,7 +487,24 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
         Array.isArray(item.dependsOn) && item.dependsOn.every((dep: unknown) => typeof dep === 'string') &&
         typeof item.priority === 'number' && Number.isFinite(item.priority) && typeof item.why === 'string')) previous = parsed;
     } catch { /* Missing or corrupt previous judgments are an empty cache. */ }
-    writeFileSync(judgments, JSON.stringify(await triageIssues(issues, judge, deps.decide, settings.tracks, previous, deps.ask)));
+    const { appendTriageTick, readTriageTicks, triageItemEvents, triageItemMetrics, triageTickBudget, triageTickCycle,
+      triageTickHealth, triageTickKey } = await import('./triage-budget.js');
+    const ticks = readTriageTicks(root);
+    const cycle = triageTickCycle(ticks.at(-1), triageTickKey(issues));
+    const budget = triageTickBudget({ cycle, issueCount: issues.length });
+    const decisions = await triageIssues(issues, judge, deps.decide, settings.tracks, previous, deps.ask, budget);
+    writeFileSync(judgments, JSON.stringify(decisions));
+    const events = triageItemEvents({ cycle, issues, decisions, previous });
+    const metrics = triageItemMetrics(events);
+    const mode = settings.mode ?? 'shadow';
+    const health = triageTickHealth({ previous: ticks.at(-1), mode, events });
+    for (const event of events) debug.log('steward.triage', 'item-event', { ...event, health: health.health });
+    debug.log('steward.triage', 'tick', { cycle, basis: budget.basis, perIssueMs: budget.perIssueMs,
+      concurrency: budget.concurrency, ...metrics, ...health });
+    appendTriageTick(root, { at: new Date().toISOString(), mode, key: cycle.key, ticks: cycle.ticks, issues: issues.length,
+      deadlineMs: budget.deadlineMs, perIssueMs: budget.perIssueMs, concurrency: budget.concurrency,
+      reused: metrics.byOutcome.reused, judged: metrics.byOutcome.judged, timedOut: metrics.byOutcome['timed-out'],
+      deferred: metrics.byOutcome.deferred, ...health, events });
   } else if (stage === 'schedule') {
     const decisions = JSON.parse(readFileSync(judgments, 'utf8')) as TriageDecision[];
     const pending = new Set(decisions.flatMap(decision => decision.dependsOn));